Analysis
-
max time kernel
119s -
max time network
106s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
18-08-2024 05:41
Static task
static1
Behavioral task
behavioral1
Sample
c4b5416544d83fac36a48a5542496930N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c4b5416544d83fac36a48a5542496930N.exe
Resource
win10v2004-20240802-en
General
-
Target
c4b5416544d83fac36a48a5542496930N.exe
-
Size
952KB
-
MD5
c4b5416544d83fac36a48a5542496930
-
SHA1
55372683bb668174feccd5d28b9b27cfcc54dfde
-
SHA256
537bb65fda8898e358d6ebe393b92cd5f790c49ba3f9a095489779a2e0d51874
-
SHA512
52338136fd04c57a1379ab24ca3b509cfa9a5a60e0e0ebed14f229eff0dea71d2e2e9203a8357f95147daf23373e11252a509c1fe66b5bc6f1a0b2f579c0323a
-
SSDEEP
24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT56:Rh+ZkldDPK8YaKj6
Malware Config
Extracted
revengerat
Marzo26
marzorevenger.duckdns.org:4230
RV_MUTEX-PiGGjjtnxDpn
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Drops startup file 1 IoCs
Processes:
c4b5416544d83fac36a48a5542496930N.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AudioHandlers.url c4b5416544d83fac36a48a5542496930N.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/1724-0-0x0000000000350000-0x0000000000443000-memory.dmp autoit_exe behavioral1/memory/1724-12-0x0000000000350000-0x0000000000443000-memory.dmp autoit_exe behavioral1/memory/1724-17-0x0000000000350000-0x0000000000443000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c4b5416544d83fac36a48a5542496930N.exedescription pid process target process PID 1724 set thread context of 2520 1724 c4b5416544d83fac36a48a5542496930N.exe RegAsm.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
c4b5416544d83fac36a48a5542496930N.exeRegAsm.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c4b5416544d83fac36a48a5542496930N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 2520 RegAsm.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
c4b5416544d83fac36a48a5542496930N.exepid process 1724 c4b5416544d83fac36a48a5542496930N.exe 1724 c4b5416544d83fac36a48a5542496930N.exe 1724 c4b5416544d83fac36a48a5542496930N.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
c4b5416544d83fac36a48a5542496930N.exepid process 1724 c4b5416544d83fac36a48a5542496930N.exe 1724 c4b5416544d83fac36a48a5542496930N.exe 1724 c4b5416544d83fac36a48a5542496930N.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
c4b5416544d83fac36a48a5542496930N.exedescription pid process target process PID 1724 wrote to memory of 2520 1724 c4b5416544d83fac36a48a5542496930N.exe RegAsm.exe PID 1724 wrote to memory of 2520 1724 c4b5416544d83fac36a48a5542496930N.exe RegAsm.exe PID 1724 wrote to memory of 2520 1724 c4b5416544d83fac36a48a5542496930N.exe RegAsm.exe PID 1724 wrote to memory of 2520 1724 c4b5416544d83fac36a48a5542496930N.exe RegAsm.exe PID 1724 wrote to memory of 2520 1724 c4b5416544d83fac36a48a5542496930N.exe RegAsm.exe PID 1724 wrote to memory of 2520 1724 c4b5416544d83fac36a48a5542496930N.exe RegAsm.exe PID 1724 wrote to memory of 2520 1724 c4b5416544d83fac36a48a5542496930N.exe RegAsm.exe PID 1724 wrote to memory of 2520 1724 c4b5416544d83fac36a48a5542496930N.exe RegAsm.exe PID 1724 wrote to memory of 2520 1724 c4b5416544d83fac36a48a5542496930N.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4b5416544d83fac36a48a5542496930N.exe"C:\Users\Admin\AppData\Local\Temp\c4b5416544d83fac36a48a5542496930N.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2520